Hello Adam, Look at point 6.3 here: http://iptables-tutorial.frozentux.net/iptables-tutorial.html There was smth in the tutorial about only the first packet from NEW connection hitting the chains and the rest of them being handled by conntrack, although can't remember where exactly this was located in tutorial. This would explain the UDP traffic being handled in its entirety since UDP is connectionless and conntrack. Note that this is my hypothesis, it's not like I have tested this thoroughly. Regards, Marcin Sunday, December 18, 2005, 2:16:21 PM, you wrote: ARK> On Sun, Dec 18, 2005 at 032:42:43M -0500, Leonardo Rodrigues Magalhes wrote: >> Adam, have you tried adding a properly PREROUTING rule for this >> specific traffic ? It would be like >> iptables -t nat -A PREROUTING -p udp -d EXTERNAL_IP_OF_NAT_BOT --dport >> 500 -j DNAT --to LOCAL_CLIENT ARK> I have tried that--same result. In fact, I've tried creating a "tunnel" ARK> between the internal and external client by leaving out the port ARK> limitation, i.e.: ARK> iptables -t nat -A PREROUTING -s SERVER_IP -j DNAT --to LOCAL_CLIENT ARK> None of these have any effect because the packets never reach the nat ARK> PREROUTING chain. If I put a LOG rule at the start of nat PREROUTING, I ARK> don't see the inbound packets from the server on the Internet. (I do see ARK> those packets in the mangle PREROUTING though). >> Other test I would suggest ....... have you tried some other UDP >> traffic, just like DNS and see if it works ? Have you tried some TCP >> traffic and see if it works fine ? ARK> Everything else seems to work fine. I have another internal box to which ARK> certain ssh connections from the Internet go, and that's fine. I'm not ARK> sure exactly how I'd test other UDP traffic... Certainly UDP traffic that ARK> is FORWARDed through the NAT box (e.g., RealPlayer streams) seems fine. -- Best regards, Marcin mailto:mark@xxxxxxxxxxxxx
